(I originally asked this question in webapps.stackexchange.com.)
By default, in Drupal, when we provide a "set new password" form, the form asks for either a site username or an email address. If the user provides either a username or email address associated with a valid account, they get an email (at that address) with a link that allows them to set a new password.
We'd like to ensure that all of our users are using a current email address, and to that end we'd like to turn off the ability to put in a username. When the user puts in a username, it may send a message to an old email address but return a "We're sending you email" to the user. If they put in an email address which we don't have, it gives them an error message, which alerts them to the fact that they haven't kept us up to date (and makes them get in touch with us by email).
Can we restrict that to only ask for email?